CVE-2025-14181: php_group php Integer Overflow or Wraparound

Vulnerability summary

CVE-2025-14181 is a medium (CVSS 6.5) Integer Overflow or Wraparound vulnerability in php_group php. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.1% of scored vulnerabilities.

Timeline

1. 25-09-2026
   PublishedVulnerability first disclosed.
2. 25-09-2026
   Last modifiedVulnerability information updated.

Description

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.